Hey @deedeekaye, it’s completely understandable to feel unsettled seeing all those login attempts, especially when they’re coming from different countries. It’s actually super common for WordPress and WooCommerce sites to get a ton of random login attempts, bots just love scanning for sites like ours and trying their luck. It usually isn’t anything personal or targeted, just the reality of running a site that’s visible online.

It’s great that Bluehost confirmed what you were seeing. Even though they can’t directly manage plugin settings, there are still a few things you can do on your end to keep things secure.

First, it’s a good idea to use a security plugin alongside your activity log tool. Something like Wordfence or iThemes Security can help block malicious IPs, limit login attempts, and give you alerts when things look suspicious. Just be sure to do your research on the best fit for your setup.

You can also enable two-factor authentication on your login page, which makes it way harder for anyone to get in even if they guess your password. Changing the default login URL with a plugin like WPS Hide Login is another easy step that helps reduce bot traffic hitting your site.

And of course, strong passwords are a must. If there are any extra admin users you don’t use, it’s smart to disable or remove them just to keep things tight.

It sounds like you’re already doing the right things by updating your PHP and staying on top of plugin updates. This kind of stuff can feel overwhelming, but once you put a few of these safeguards in place, it gets a lot more manageable.

You’re asking the right questions, and you’re on the right track.